Fallos del tipo CWE-330

196 resultados

Uso de valores insuficientemente aleatórios

A aplicação gera números ou sequências que deveriam ser impprevisíveis (tokens, IVs, salts, chaves) usando métodos fracos ou com baixa entropia. Um atacante consegue adivinhar ou reproduzir esses valores, comprometendo criptografia, autenticação ou geração de identificadores únicos.

Ejemplo

Um sistema gera tokens de sessão usando Math.random() em JavaScript ou rand() em C, que são determinísticos e preditíveis. Um atacante observa alguns tokens válidos e consegue calcular os próximos, sequestrar sessões de outros usuários.

Cómo mitigar

Use geradores criptograficamente seguros: java.security.SecureRandom em Java, secrets ou os.urandom() em Python, crypto.getRandomBytes() em Node.js. Gere valores com entropia adequada (no mínimo 128 bits para tokens) e nunca reutilize sementes.

CVE-2023-32831MEDIUMIn wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure wiEPSS 0.2%CVE-2026-40306MEDIUMDNN has same HostGUID for all new installsEPSS 0.2%CVE-2026-41701MEDIUMIn Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesEPSS 0.2%CVE-2025-13353HIGHgokey allows secret recovery from a seed file without the master passwordEPSS 0.2%CVE-2026-41838MEDIUMSpring Framework Predictable Session ID in WebSocket ModuleEPSS 0.2%CVE-2026-19735MEDIUMPredictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stackEPSS 0.2%CVE-2026-14702LOWzcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random valuesEPSS 0.1%CVE-2026-47703MEDIUMAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleEPSS 0.1%CVE-2026-23999LOWFleet: Device lock PIN can be predicted if lock time is knownEPSS 0.1%CVE-2026-50208CRITICALPermissive TrustAllCerts TLS VerificationEPSS 0.1%CVE-2024-51346HIGHAn issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.EPSS 0.1%CVE-2026-79981MEDIUMDNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofingEPSS 0.1%CVE-2024-21460HIGHUse of Insufficiently Random Values in CoreEPSS 0.1%CVE-2026-76105HIGHDell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticatedEPSS 0.1%CVE-2026-21444MEDIUMlibtpms returns wrong initialization vector when certain symmetric ciphers are usedEPSS 0.1%CVE-2026-94618MEDIUMFileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archiveEPSS —